Support Forum

Hello All,We have a site-to-site IPsec VPN between an on-premises FortiGate 100F and a remote FortiGate providing access to Azure-hosted applications.We are experiencing intermittent slowness when accessing one specific Azure application. The issue is reported by users almost every day after 5:00 PM.So far, we have:Verified Phase 1 and Phase 2 VPN configurations Verified routing and firewall policies Confirmed the tunnel remains up during the issue Reviewed security profiles (AV, IPS, SSL Certificate Inspection) and found no obvious impact Adjusted TCP MSS values (1350 on the tunnel interface and 1380 on the policy)While reviewing VPN event logs, I noticed multiple "Invalid ESP packet detected" messages. Today, one such event was logged at 5:12 PM, which coincided with user complaints about application slowness.Has anyone experienced a similar issue? Could the "Invalid ESP packet detected" logs indicate packet drops, MTU/fragmentation issues, rekeying problems, or another IPsec-related

Configuring a static IPv6 address on client fails with state "dadfailed"When configuring an IPv6 address the system sends out a message to check if the address if already in use.If the Fortigate has ippool6 type nptv6 configured it acts it replies on the external-prefix configured.Similar to arp-reply enable.Adjust the nptv6 pool itself or adjust the client by using an address in the internal-prefix range or not affected by ippool6.Check other ippool6 and vip usage for overlap as well. Example On linux client: ip -6 addr EXTERNALIP shows state dadfailedDirectly after configuring the ip address we get the packet capture:  VMMAC > 33:33:ff:00:00:06, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) :: > ff02::1:ff00:6: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has EXTERNALIP  FGTMAC > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::FGTEUI-64 > ff02::1

Hi ,We have a FortiGate VM pair running in HA  and a FortiWEB pair running in HA, these were fabric integrated when both on the 7.4.x train, however we upgraded to the 7.6.x train (a we while ago now) and this broke the Fabric Integration.We have deleted all the integration configuration (that we know of) and started from fresh but they still will not connect.We are adding via serial number .On the FortiGate it just says “Offline” under the Fabric Connector for the FortiWEB and on the FortiWEB it just has a red round circle with a line through it.Any clues as where to look next ? Regards  

I have a web application for customers to order food & beverage items through a mobile app.the web application is sitting on the DMZ segment.printing of orders is to be done through printers in the LAN print/print server. Can this work ?DMZ web appication through tablets/smartphones -> LAN printer normal printing protocols like smb, tcp/udp 137/138.or can i do wireless printing 

So after all the fuss, the updates still haven't been pushed out to automatic update via the device GUI ?There's already AI based diff analysis working out what has changed and the only way to avoid potential problems is to manually update , if they haven't pulled the download while you were looking at itDoes anyone at Fortinet know what they're doing ? 

WAN1 STOPPED WORKING- I have two FortiGate 60F setups as stack (HA1 and HA2)- I have Juniper router - I have a Rogers modem with 2 public IP 187.x.x.x/30 and 184.x.x.x/30- link 1: Rogers modem port1 > FG60F WAN1- link 2: Rogers modem port2 > Juniper router- I also have a 2nd ISP (TELUS) for failover- WAN1 link shows Green UP in the GUI; WAN1 led light is blinking green/yellowProblem: WAN1 is not pulling the public ip whether in static or DHCPTS:- reboot the modem, connect my laptop with correct IP details used in FG60F (SM, GW and IP) = WORKING- leave Juniper plugged in = WORKING- turned off the modem for 10mins, removed the laptop, reconnected the FG60F = FAILED- Juniper still working- Replaced modem, reprovisioned and performed laptop testing again and still working. - Tried disconnecting Juniper from Rogers modem and leave only FG60F connected = FAILED- Internet works because of WAN2 (TELUS)Question:1. Why WAN1 not pulling the public IP? why there is no internet from WAN1? 2.

Hello, everyone. I'd like to confirm something: I can't find the Fortigate 600E model on the Fortigate lifecycle page to check the end-of-support date. Does this mean the device will continue to receive firmware updates, security patches, and other updates?I’ve also seen some websites mentioning dates this year, but if it doesn’t appear on the official Fortigate website, I guess those are just rumors, right?Thanks for your responses.

Hi Team,I cannot find the FortiGuard entry on the following page anymore: https://fortiguard.fortinet.com/psirt/FG-IR-26-186When I checked it yesterday, it was listed under the "Under Investigation" section. However, it is no longer visible under either "Under Investigation" or "Not Affected Products" today.While FortiOS has been determined to be unaffected, could you please clarify whether FortiGuard (as a component of FortiOS) is also considered unaffected, or if it is still under investigation?Also, could you let us know why the item was removed from the page?Best regards,

By default if we enable MFA on fortinac for accessing web admin then the token will be expired only in 1 minute.I think 1 minute i’s to fast if we have problem with delay when we receiving the token by email. Can we increase the token expiration example to 5 minutes? 

We currently use FortiClient EMS 7.4.7 and want to assign the endpoint profiles with userbased AzureAD groups. Currently it works only with devicebased AzureAD groups. When I add  user to to the AzureAD group und resync I noticed the the user is synced with the EMS, but the device from the user is not assigned to the profile.The Fortinet Support means that it is a bug, but perhabs it is a incorrect configuration in the claims or anything else.Has anyone use userbased AzureAD groups with the version?

Hi all,I am deploying FortiNAC-F FN500F v7.6.x in a Primary/Secondary HA configuration.Is there any requirement for Port2 Isolation IP addresses to be the same on both Primary and Secondary nodes in both Layer 2 and Layer 3 HA deployments?

I have configured a dial-up IPsec VPN using IKEv2 for remote users. While working on the configuration and reviewing the documentation, I realized that it seems there is no way to separately control who is allowed to establish the VPN connection and then apply specific firewall policies once they are connected.In other words, if I configure Phase 1 authentication with "inherit policy", it appears that any user belonging to any group referenced in the firewall policy can successfully bring up the VPN tunnel. Is that correct?If so, what would be the recommended way to restrict which users are allowed to access the VPN, while also ensuring that, once connected, different firewall policies are applied based on the user's group membership?

We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 ) the kids have discovered a number of gaming sites on google homepages, all seem to be named "unblocked games" i.e.https://sites.google.com/site/unblockedgames4mehttps://sites.google.com/site/unblockedgames77https://sites.google.com/site/punblockedgames/ The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name. I put in a simple IPV4 policy, source = any,  Destination = "sites.google.com/site/unblockedgames4me",  blockand it doesn't work.  because it is a block there is no SSL inspection or anything like that.... When I look at the log there is nothing that says "sites.google.com/site/unblockedgames4me" just "encrypted-tbn1.gstatic.com" but I don't want to blo

Hello Fortinet Community,I would like to integrate FortiEMS ZTNA with a third-party Privileged Access Management (PAM) solution, such as JumpServer.With FortiPAM, I can associate specific ZTNA tags with secrets and restrict access based on endpoint compliance. A user must have the required ZTNA tag from FortiEMS to access a specific secret or target server.I would like to achieve the same functionality with a third-party PAM solution.My questions are: Can a third-party PAM, such as JumpServer, integrate with FortiEMS to retrieve or verify endpoint ZTNA tags? Can the PAM check the user's endpoint tag before allowing access to a specific target server or secret? Is there an API or another supported integration method to achieve this? Does this require a FortiGate ZTNA deployment, or can the integration work directly between FortiEMS and the third-party PAM? Our goal is to use FortiEMS for endpoint posture assessment and enforce tag-based access control within the PAM, similar to th

Environment:- FortiClient VPN (free, VPN-only) 7.4.3.4323- macOS Tahoe 26.7.1 (iMac)- IPsec IKEv2 tunnel with SAML SSO/MFA, NAT-T (UDP 4500)- Not connected to EMS (log shows "Ignore Secure compliance Check as FCT is not connected to EMS")Problem:The VPN tunnel is disconnected by FortiClient itself less than one second after the macOS screen is locked. This happens even when the system is prevented from sleeping (display sleep and screensaver disabled, sleep prevented with a keep-awake utility) and while traffic is actively flowing through the tunnel.Steps to reproduce:1. Connect the IPsec IKEv2 tunnel with SAML SSO.2. Keep traffic flowing through the tunnel (e.g. a TCP check every 60 seconds to an internal host).3. Disable screensaver and display sleep, prevent system sleep.4. Lock the screen (Ctrl+Cmd+Q).5. The tunnel is disconnected within ~0.7 seconds.If the screen is not locked, the tunnel stays up indefinitely, so this is not an idle timeout, a network issue, or a gateway-side dis

Anyone else suddenly having issues seeing Chatgpt prompts and files uploaded? Application Control | FortiGuard Labs Was working last week and i can still see claude file uploads and prompts just not ChatGPT so not sure if the application signature has changed? Fortigate is 7.4.12

We have a new firewall configured and now its configured as Hub for dial up tunnels to other branches..We have many vlans in subinterfaces and they are combined to created a zone,we have added this zone as source interface in the firewall policy to reach other branchesbut then we unable to ping other branches using this zone/vlanwhile the other branches are able to ping the hub vlans without any issues

Can anyone provide any guidelines for remote ipsec VPN with fortigate 7.6.6 os & its integrate with LDAP local user many more members ? 

Hi everyone,just wondering - does anyone have any info when there's gonna be IPS signatures for the recent critical PHP vulns? Other vendors have them in place already I think. 

Hello, Can i deploy FortiGate VM on Huawei private cloud? is it supported and compatible ?  And could you please advise what are the supported hypervisors/platforms on Huawei private cloud for the VM Deployment? And does this one ( Huawei Cloud EulerOS 2.0 64 bit - CentOS 7.9 ) supported for FortiGate VM deployment ? Thanks in advance

Hi, community Forti. I have a fortigate 100D but a WAN port broke down; now ot only gives me 10 mbps instead of the normal speed. So I want to use a LAN port as a WAN port but a I have some questions.The Lan port can fuction properly? The speed is 100 mbps The Wan port can be repaired?I know that I need change policies and more things. All for the LAN port.

I've been brought in to help an organisation with a large branch network get proper value from their FortiManager. It was set up by someone else and never became the single source of truth. They want to push policies, templates, firmware and switch and AP settings from FortiManager, with no policy mismatches and no per-firewall changes. It's a live environment, so any approach has to avoid outages.EnvironmentFortiManager VM 7.6.x in HA, with several ADOMs100+ FortiGates (mixed 60F, 40F and 100F class units) all on the same FortiOS 7.4.x buildA large number of FortiSwitches and FortiAPs through FortiLinkHub-and-spoke SD-WAN, which works fine and is out of scopeWhat I found (read-only access)Far more policy packages than makes sense for the number of devices, and many devices have a package to themselves. This looks like cloned packages instead of meta variables and dynamic mappings.A number of devices show Modified config status, concentrated in one ADOM, and I haven't seen any Synchron

Hi everyone,We are experiencing a serious issue with the Automation Playbooks functionality in FortiAnalyzer 8.0.1 following an upgrade from FortiAnalyzer 7.6.x.All automation playbooks were working correctly on FortiAnalyzer 7.6.x. However, after upgrading to 8.0.1, multiple playbooks using different connectors stopped working.Environment: FortiAnalyzer VM: 8.0.1 Previous FortiAnalyzer version: 7.6.x FortiClient EMS: 8.0. 1. FortiClient EMS ConnectorThe FortiClient EMS connector is configured, enabled, and displayed as healthy (green) under Active Connectors.However, running actions such as Get Endpoints or Get Vulnerabilities fails with:Failed to execute task "Get Endpoints":cannot access local variable 'connection'where it is not associated with a valueThe same error occurs when using a newly created EMS connector task.2. Active Directory ConnectorAutomation tasks using the Active Directory connector also fail:Failed to execute task "Get User from AD":cannot access local variabl

Network Components:2 ISP (SDWAN)2 FW(HA)2 RTR(Redundant WAN)1 SW(L3)Current setup: LAN(L3) → FW(HA) → ISP(SDWAN) → NET                           ^→ RTR(WAN) → NET                          Routing: L3 SWChange to:  LAN(L3)--->FW(HA)-->ISP(SDWAN) →NET                                          ^→ RTR(WAN) → NET                                           Routing: FW(HA) Routing Architecture ChangeCurrently, the L3 Switch performs the routing for traffic destined for the WAN. Under the proposed design, WAN-bound traffic will instead be routed through the Firewall before being forwarded to the WAN Router.Considering the full-mesh redundant topology:Firewall HA: Active-Passive WAN Routers: Active-PassiveWhat would be the best interface design between the Firewall and WAN Routers to maintain redundancy while avoiding routing or loop issues?

What is the latest recommended and stable FortiOS version for our FortiGate 60F?What is the recommended upgrade path, and could you please provide the step-by-step procedure for upgrading the FortiGate firewall from its current version to the recommended stable version?